neconyd | 65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3

General

Target

65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3.exe
Size

33KB
MD5

b4fb7aa55093dabeb9843970eb9914d1
SHA1

bb1aab0f590f8771b286ff584da3ad6000a7fdf1
SHA256

65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3
SHA512

1bf4345bd11957f2a66000b8a5253970ab2cc275d83d83ab035a56da6bad87b1607af3d1d29af8a2606ea1da9247478f2913bf89ea009c97ba467d563a0f55e1
SSDEEP

768:/fVhP/4kt3+9IV6Y90ksQ1oWHT0hh0vy9S5fsYGbTmoN/yE56hlSQ7D/:/fVRztyHo8QNHTk0qE5fslvN/956qo

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 3 IoCs

pid	Process
2896	omsecor.exe
1188	omsecor.exe
2080	omsecor.exe

Loads dropped DLL 6 IoCs

pid	Process
1872	65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3.exe
1872	65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3.exe
2896	omsecor.exe
2896	omsecor.exe
1188	omsecor.exe
1188	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2896	1872	65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3.exe	30
PID 1872 wrote to memory of 2896	1872	65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3.exe	30
PID 1872 wrote to memory of 2896	1872	65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3.exe	30
PID 1872 wrote to memory of 2896	1872	65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3.exe	30
PID 2896 wrote to memory of 1188	2896	omsecor.exe	33
PID 2896 wrote to memory of 1188	2896	omsecor.exe	33
PID 2896 wrote to memory of 1188	2896	omsecor.exe	33
PID 2896 wrote to memory of 1188	2896	omsecor.exe	33
PID 1188 wrote to memory of 2080	1188	omsecor.exe	34
PID 1188 wrote to memory of 2080	1188	omsecor.exe	34
PID 1188 wrote to memory of 2080	1188	omsecor.exe	34
PID 1188 wrote to memory of 2080	1188	omsecor.exe	34

C:\Users\Admin\AppData\Local\Temp\65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3.exe
"C:\Users\Admin\AppData\Local\Temp\65d5017e053b23fbcfa34607137019ab58e488c4753f51a905d402fce82fdcc3.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1188
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
33KB

MD5
e93700c04a2acca4562f5e8bc520dfe2

SHA1
36a38201996dd8f8a45497c2e02faa421366dfc0

SHA256
b3f090aea96180d067de8acbd2ba30d89e70c9ae74fd281434e9b04be29b10ff

SHA512
02793a34a59bf4bf1f854a812e513e8122fe63d4c32cdbc21217c6924f7809667c77d4a212b6e365be67e6b641a2dac1ca03036fb206e64ef40368108a69811d

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
33KB

MD5
cd524129797d083a3fbc01d064df349d

SHA1
f5573bad2c942f9765d7d8c226082f9b24a103a1

SHA256
aa35c4f66482ce9ad34f26688856c59660f5ea598de0aa74303098eaa68f8352

SHA512
b640d1605af70730105c1b55f8b1d651ae2dba433c247a3c2a957ec37ed8d001607ef67c395f347dfe2c46079773bc2f5f641630e110b4ac457e3fcfb9ad3c11

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
33KB

MD5
ad6331c7c27e57c194fb6412cdfb5e60

SHA1
2d4b22bc647914915f64c23925069fc986717135

SHA256
ebbbc59fb75d0eaa05c99525ab1a0490612ebd541b1204617ebf9bd58c0834ac

SHA512
aa8aa4c3bdfff587c8a6179d482e89e5101fe888339d684573b958cb9d36d764bc62082f096dd5ee5b46c8c45ed41669abe338a1d55f0aed581ced050132526b

Download Submit
memory/1188-45-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1188-39-0x0000000000220000-0x000000000024A000-memory.dmp

Filesize
168KB

Download
memory/1872-4-0x00000000002B0000-0x00000000002DA000-memory.dmp

Filesize
168KB

Download
memory/1872-10-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1872-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2080-51-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2080-48-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2896-23-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2896-33-0x0000000000280000-0x00000000002AA000-memory.dmp

Filesize
168KB

Download
memory/2896-32-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2896-27-0x0000000000280000-0x00000000002AA000-memory.dmp

Filesize
168KB

Download
memory/2896-20-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2896-17-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2896-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2896-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing